A Roti Moden Mediterranean restaurant is seen Dec. 28, 2016, at 80 E. Lake St. in Chicago. The company has been hit with a lawsuit alleging it has been printing too many customer credit card digits on receipts.

A Roti Moden Mediterranean restaurant is seen Dec. 28, 2016, at 80 E. Lake St. in Chicago. The company has been hit with a lawsuit alleging it has been printing too many customer credit card digits on receipts. (Phil Velasquez / Chicago Tribune)

Two consumers have filed a class-action lawsuit against Roti Modern Mediterranean, claiming the chain prints too many digits of customer credit card numbers on sales receipts, a practice they say puts diners at risk for identity theft and credit card fraud.

The complaint, filed Dec. 16 in Cook County Circuit Court, alleges that Roti is violating a federal law prohibiting companies from printing more than the last five digits of a debit or credit card on a sales receipt. Roti allegedly printed the first six and last four digits.

"Somebody would only have to figure out those other six digits to have a full card," said Paul Markoff, partner at Markoff Leinberger, the firm representing the plaintiffs in the case.

Roti is a fast-casual restaurant that serves Mediterranean food. It operates 12 locations in Illinois, with one more set to open soon, according to its website.

The two plaintiffs named in the case are Illinois residents Cooper Lindner and Kim Smith, both of whom used Visa cards to make a purchase at Roti in July. Smith and Lindner's receipts displayed 10 digits, according to court documents.

The information identity thieves are most interested in getting their hands on are full, 16-digit credit card numbers, said Jim Speta, a professor at Northwestern University's Pritzker School of Law.

It's unclear whether printing five digits would keep consumers safer than printing six, for example, but the theory is "more digits increase the risk of identity theft," he said.

Phil Velasquez / Chicago Tribune

A Roti Moden Mediterranean restaurant receipt is seen Dec. 28, 2016, at a restaurant at 80 E. Lake St. in Chicago. A lawsuit alleges Roti has been printing too many customer credit card digits on receipts; this receipt shows four digits, which meets federal law.

A Roti Moden Mediterranean restaurant receipt is seen Dec. 28, 2016, at a restaurant at 80 E. Lake St. in Chicago. A lawsuit alleges Roti has been printing too many customer credit card digits on receipts; this receipt shows four digits, which meets federal law. (Phil Velasquez / Chicago Tribune)

Thieves can use the 10 credit card digits to persuade the consumer to turn over more sensitive information, the complaint alleges. It's also easier for them to guess six digits than the 11 that the law states should be blocked out.

This is not the first iteration of the lawsuit. Lindner and Smith first filed a suit in the U.S. District Court of Northern Illinois, Eastern Division, in July, bringing similar allegations against Roti.

The Chicago-based restaurant chain moved to dismiss the case, saying that the first six credit card digits are "the numeric equivalent of the card's issuing bank," and that no harm came from printing those digits.

Those numbers do relate to bank information, said Ed Haag, president of Schaumburg-based consulting firm Undo Identity Theft, but he said printing them should be a concern for banks and consumers.

"It's one more hurdle (the banks) have to protect against because it could give (identity thieves) some type of access," Haag said.

Ultimately, Lindner and Smith filed documents to dismiss the case in federal court. The U.S. Court of Appeals ruled in another case that damage must have been done for the case to have a standing in federal court. Since neither Lindner nor Smith's identities had been stolen, they decided to move the case to state court, Markoff said.

The suit could represent more than 100 people, Markoff said. The plaintiffs asked the court to certify a class for the suit, bar Roti from printing more than the last five digits of credit cards on receipts, and require Roti to pay damages.

Roti CEO Carl Segal said in a statement that the plaintiffs' claims still have no merit.

"There have been no allegations that anyone's credit card information was ever compromised and Roti is not aware that anything like that happened," he said. "We will vigorously defend this lawsuit."

Other companies that have been accused of violating the Fair and Accurate Credit Transactions Act and printing too many numbers on receipts include Costco and Burger King.